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Secure random numbers are a fundamental element of many applications in science, statistics, 
cryptography and more in general in security protocols. We present a method that enables the 
generation of high-speed unpredictable random numbers from the quadratures of an electromag¬ 
netic field without any assumption on the input state. The method allows to eliminate the numbers 
that can be predict due the presence of classical and quantum side information. In particular, we 
introduce a procedure to estimate a bound on the conditional min-entropy based on the Entropic 
Uncertainty Principle for position and momentum observables of infinite dimensional quantum sys¬ 
tems. By the above method, we experimentally demonstrated the generation of secure true random 
bits at a rate greater than 1 Gbit/s. 


Introduction - Quantum Random Number Generators 
(QRNG) exploits intrinsic probabilistic quantum pro¬ 
cesses to generate true random numbers. Indeed, the 
expression “QRNG” was first introduced for a device 
based on the decay of radioactive nuclei [T]. Afterwards, 
QRNGs exploiting the versatility of light were realized: 
such devices are based on optical processes such as pho¬ 
ton welcher weg las], photon time of arrival or 

vacuum quadratures [HHII]. 

Usually, the assessment of the randomness of the gen¬ 
erated numbers is obtained by applying statistical tests 
on the output bits. In most of the QRNGs, passing the 
tests is the only method used to certify the randomness. 
In case of failure (attributed to hardware problem since 
the process is assumed to be “random”), numbers are 
algorithmically post-processed until the tests are passed. 

However, this procedure con only certifies that the 
numbers are identically and independently distributed 
(i.i.d.) with respect to those [12] applied tests. Indeed, 
a posteriori statistical tests cannot certify that the num¬ 
bers are not known to someone possessing side informa¬ 
tion about the generator. For instance, it is not possible 
to eliminate hardware noise, which is a source of classi¬ 
cal side information for an eavesdropper, Eve, who may 
be able to control it. Hence, a statistical test a pos¬ 
teriori cannot establish whether the numbers are origi¬ 
nated by the quantum process or by the noisy hardware. 
Moreover, even assuming a QRNG with an ideal noise¬ 
less hardware, a statistical test cannot reveal whether 
the outputs arise from a a quantum measurements and 
then are intrinsically random. For instance, a polariza¬ 
tion welcher weg QRNG with an optical source emitting 
photons in a completely mixed polarization state can be 
seen as the photonic version of a fair coin. The random 
sequence can be predicted by Eve if she knows “the coin’s 
equations of motion” (namely she has classical side infor¬ 
mation) or if she holds a quantum system correlated with 
the QRNG (namely she has quantum side information). 

The quantity that evaluates the amount of side infor¬ 
mation on a random sequence Z is the so called con¬ 
ditional quantum min-entropy H^[^{Z\E) [13]. How¬ 


ever, such min-entropy is generally hard to estimate. 
For instance, in the Device Independent (DI) framework, 
Hmin{Z\E) can be related to violation of a Bell’s in¬ 
equality. However, these protocols are very demanding 
from the experimental point of view since they require a 
loohole-free Bell tests [MlHB] . 

In this work we propose and experimentally realize an 
efficient protocol for the secure and ultra-fast generation 
of random numbers able to evaluate a lower bound for the 
conditional quantum min-entropy. The method assumes 
a trusted measurement device and a complete untrusted 
source, i.e. a source-device-independent (SDI) scenario. 

The bound is estimated by exploiting the entropic un¬ 
certainty principle for infinite dimensional quantum sys¬ 
tems, by adopting the method introduced in HZ] for the 
finite dimension case. We note that, similarly to the pro¬ 
tocol introduced in the present scheme does not re¬ 
quire any assumption on the dimension of the Hilbert 
space of the source. Fast generation rate is provided by a 
continuous variable (GV) scheme based on the measure¬ 
ment of quadrature observables of the electromagnetic 
field. 

Review of CV-QRNG - In a typical scenario, a GV- 
QRNG user (Alice) generates random numbers by mea¬ 
suring the momentum quadrature P of a quantum state 
pA (typically the vacuum) of an electromagnetic field 
mode. With CV systems, the finite resolution of the 
experimental devices leads to a “discretization” of the 
measurements (see Supplementary Informations (SI) for 
more details). More specifically, a coarse grained version 
of a quadrature operator, e.g. Psp^ can be obtained by 
introducing a partition Vsp = of its possible output 

values p G M. In the above expression, are given by 
the half-open intervals = [kSp, {k E l)6p] with k eN 
and 6p the precision of the measurement. Alice mea¬ 
sures the POVMs {Pjl} with elements Pj^ = fjk dp\p){p\ 

and stores the outcomes pk appearing with probability 
p{pk) = ^^[pA^Sp] ^ classical register Psp. 

For cryptographic applications Alice needs to evalu¬ 
ate the probability pguess(^(5p|^) = that 
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FIG. 1. Random numbers are obtained by measuring the position quadrature of a Gaussian state with optical homodyne. 
These numbers are “secured” by applying a strong randomness extractor calibrated on a conservative bound of Hmin{Psp\E). 
Such bound is obtained by randomly measuring the complementary quadrature, i.e. the momentum one. Part of the secure 
bits are “re-invested” in the process to sustain the random quadrature switching. 


an adversary (Eve) has to guess correctly the outcome 
of a measurement by adopting an optimal strategy. The 
guessing probability depends on the quantum conditional 
min-entropy H^[^{Psp\E)^ which represents the maximal 
content of true random bits achievable for each measure¬ 
ment from the system A, i.e. uniform and uncorrelated 
from any classical or quantum side-information held by 
an eavesdropper [151 HI] • 

Previous works on CV-QRNGs assumed that the state 
pA is pure [9]. In this case, the conditional min- 
entropy reduces to the classical min-entropy Hoo{Psp) = 
— log 2 [max/e p(p/e)]. Eve’s best strategy consists in bet¬ 
ting on the most probable value, namely pguess{P6p) = 

max/j; Tr , according to the Born rule. Other 

works assumed the eavesdropper intrusion limited to the 
classical noise jO] |TT] which unavoidably affects the ex¬ 
perimental apparatus. However, to generate true ran¬ 
domness it is necessary to consider also quantum side 
information: indeed, the most general scenario contem¬ 
plates the possibility of an eavesdropper having access to 
a quantum system E correlated with the system A. It is 
worth to stress that such scenario is not paranoid but it 
results from relaxing the strong assumption of the system 
A being in a pure state. 

SDI-CV random number generator - In the untrusted 
source scenario, the state pA is in general mixed: it can be 
purified by a state pae, namely pA = Tr^; [pae] where 
E can be identified with the already mentioned eaves¬ 
dropper, or with the system “environment”. We note 
that the mixedness of pA corresponds to common phys¬ 
ical situations: any decoherence or imperfection in the 
state preparation leads to correlations with the environ¬ 
ment E. In this general case, Alice can estimate the ex¬ 
act value of H^i^{Psp\E) only by performing a complete 
quantum state tomography. 

However, an alternative and simpler approach consists 
in estimating a lower bound. This can be obtained by 
exploiting the entropic uncertainty principle (EUP) for 


conditional min- and max-entropies in the presence of in¬ 
finite dimensional quantum memories introduced by Eur- 
rer et al. [19]. The EUP can be summarized as follows: 
let’s consider a tripartite state ojabe with Alice, Bob and 
Eve holding infinite dimensional quantum systems A, B 
and E respectively. Alice measures quadratures Psp and 
Qsq on uja = Et be [^abe] and she stores the outcomes 
in two classical systems Psp and Qsq. The EUP is written 
as 

Hmm{PSp\E) + HmAQSq\B) > - log 2 c{6q, Sp) , (1) 

where 

ciSq, dp) = Edqdp ■ 4'^ (^1, (2) 

and is the 0 ^^ radial prolate spheroidal wavefunction 
of the first kind [20] . In Eq. Q, H^i^{Psp\E) quantifies 
Eve’s uncertainty about the outcomes pk , while the con¬ 
ditional max-entropy Hmax{Q6q\B) expresses Bob’s lack 
of knowledge about Qk. The term c{6q,6p) is the “in¬ 
compatibility” of the measurement operators, i.e. it is 
maximal if the operators are maximally complementary. 

Eor a QRNG, the system B is set to trivial and from Eq. 
0 it is straightforward to derive H^[^{Psp\E) > i^pow 
with 

-f^LOw(-P(5p|T’) = lc)g2 ^(^^5 ^P) -f^max(Q(5g) 5 (3) 

and H^g,^{Qsq) the Renyi entropy of order 1/2. 

Our method to estimate the content of true random 
bits for source-device-independent CV-QRNG is summa¬ 
rized in Eig. and works as follows: I) Alice prepares 
the state pA (the vacuum or a squeezed vacuum), mea¬ 
sures it in the P quadrature (called data quadrature) 
and generates raw random numbers; H) the measure¬ 
ment is randomly swapped to the Q quadrature (called 
check quadrature): Alice estimates H^g,^{Qsq) by using 
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FIG. 2. Comparison between classical and conditional min- 
entropy. Green solid lines represent the bound on quantum 
conditional min-entropy, Hlow{P\E)^ while red dashed lines 
are the classical min-entropy, Hoo{P), evaluated for a vac¬ 
uum state (left) and a thermal state (right) with variance 
cTvac = 1/2. The conditional min-entropy Hmin{P\E) lies be¬ 
tween Hlow{P\E) and Hoo{P). For the vacuum state, both 
estimators attain the same value when the precision of the 
measurement increases (5^0. For the thermal state, i.e. a 
mixed state, the classical min-entropy always over-estimates 
the true content of randomness with respect to the quantum 
conditional entropy. 


the outcomes of the check measurements by 

HmaxiQSq) — 2 log 2 ^ ^ a/p(^/c) 5 (4) 

k 

III) the bound of Hmin{P6p\E) is evaluated by using Eq. 
(§; IV) a quantum randomness extractor calibrated on 
the bound is applied to the raw random numbers. An 
initial random seed for the measurement switching is re¬ 
quired, but the protocol is able to quadratically expand 
the initial randomness as in the protocol introduced in 

HZ]. 

The measurement of the Q operator can be regarded 
as a tool to estimate, with a partial tomography, whether 
the state pA is pure or not. In order to better illustrate 
our approach, in Fig. we compare the classical min- 
entropy HooiPsp) and the bound in Eq. as a function 
of the precision S = 6q = 6p. The quantum min-entropy 
is bounded by these two values, namely Hlow{P6p\E) < 
Hinin{P6p\E) < H^{Psp). Two different input states pA 
are considered: the vacuum state, with variance = 
1 / 2 , and a thermal state with variance — 1/2 + ya, 
where /i = 2 is the mean photon number. Eor low 6^ 
the classical min-entropy and the bound can be evalu¬ 
ated analytically, giving Hoq{Ps) — — log 2 / ^ and 

V^(i+^) 

H^ow{Psp\E) - HAPs) - 21og2 ^i93(0,e-^V(2+4^)) 

with 'd 3 {z,q) = the Jacobi theta-function 

(see SI). 

Eor pure states, equality between HminiPsp) and 
Hmin{P6p\E) is expected and this is the case for the vac¬ 
uum. On the other hand, for a thermal state, the classical 
min-entropy always overestimate the content of true ran¬ 


domness. A thermal state is indeed mixed and it can be 
interpreted as pA being correlated with the environment 
system E: the gap between the two entropies corresponds 
to the possible leakage of information due to this corre¬ 
lation (Cfr. SI for a detailed discussion). We also note 
that when 5q is large, the bound in Eq. (§ underes¬ 
timates the number of true random bits extractable per 
measurement because the lower precision implies a looser 
estimation of the input state. 

Classieal side information - In our SDI framework, 
Alice controls and trust the measurement device. We 
assume that Alice optimizes her hardware to not spoil 
the independence and uniformity of the numbers (e.g. 
by oversampling the signals, by using unbalanced beam¬ 
splitters etc.). We now show that our method take into 
account effectively also classical side information. In¬ 
deed, even if pA were pure and the generator is opti¬ 
mized, the hardware anyway features an intrinsic clas¬ 
sical noise which “adds in quadrature” to the quantum 
signal. The result is an increase of the quadrature vari¬ 
ance with respect to the shot-noise limit 1 / 2 , see Si Eig. 
S3. Eor example, for the vacuum input state one ob¬ 
serves a variance of = 1/2 + (rinoise) in all quadra¬ 
tures, as for a thermal state. Because Alice cannot dis¬ 
tinguish whether the input state is mixed or pure, the 
protocol considers the security most conservative option: 
any observed “mixedness” is treated as if it is caused by 
some quantum eavesdropping strategy, i.e. the system 
A entangled with Eve’s system E. Hence any kind of 
side information will be erased applying quantum ran¬ 
domness extractors [2TH23] properly calibrated with the 
conditional min-entropy lower bound. It is clear that 
the check quadrature has to be measured at random in¬ 
stants. This prevents Eve to carry out deception strate¬ 
gies during the check measurements. Therefore Alice is 
now able to conservatively bound the amount of true ran¬ 
domness both if an adversary holds a description of the 
post-measurement classical-quantum state or may get ac¬ 
cess to the classical noise. It is worth noticing that the 
real-time estimation of H^i^{Psp\E) provides a dynamic 
resiliency against drifts of the classical noise, possibly due 
to not constant experimental conditions, e.g. tempera¬ 
ture variations or interference with external e.m. fields. 

The experiment - We built a CV-QRNG based on a 
homodyne scheme for the measurement of vacuum fluc¬ 
tuations. We implemented an all-in-fiber setup with off- 
the-shelves devices: the local oscillator was a narrow line 
1550 nm laser connected to one input of a fiber 50:50 
beamsplitter and the vacuum entering from the unused 
port. The exiting ports were connected to a balanced 
receiver with a bandwidth of 1.6 GHz. The output dif¬ 
ference current signal was then sampled at an equivalent 
rate of 1.25 GS/s by a 12 GHz bandwidth fast oscilloscope 
(see SI). We identified the momentum and the position 
observables as the data and the check quadratures re¬ 
spectively. To simulate the active switching between the 
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complementary observables (which shall be implemented 
with a LO phase shifter), random subsets were extracted 
from the whole set of outcomes and attributed to the 
position quadrature. 

As an example, we present the results obtained on a 
typical run of m ~ 6 • 10^ data samples. The measured 
check quadrature variance is = 0.677, i.e 35.4% 
larger than the theoretical value of 1/2, as consequence of 
the electronic noise which is then treated as an impurity 
of the input state. 

In Fig. 1^ the lower bounds Hi^o^j\/{Psj\E) of the en¬ 
tropy are reported as function of the oscilloscope res¬ 
olution. A j-bit resolution corresponds to a precision 

= Pmax2^“-^ with Pmax related to the oscilloscope full- 
scale setting. We evaluated the bounds for classical sys¬ 
tems Psj and Qsj for different resolutions from 1 bit (S^) 
to 8 bits (Sq). Each point was obtained by averaging 200 

bound values ^LOw(n, |^) = log 2 ( 


1 -2 

1 ^ 

-L, 4 


HmaAQSj), being i7max(Q^,) the Bayesan estimator (cfr. 
El) of the max-entropy evaluated on 200 random sub¬ 
sets of size riQ = m ' with i = 2 ... 5. 

The plot shows the interplay between the resolutions 
and uq in the estimation of the bounds. Indeed, for 
high precision and large ng, the reconstruction of the 
check quadrature distribution bocomes more accurate. 
In agreement with Fig. (Right), classical min-entropy 
overestimates the real content of entropy. In particular, 
for ^5 (resolution of 3 bits) H^{Ps) already attains the 
unit value while the conditional entropy is negative. This 
is because our input state distribution is narrow with 
respect to the oscilloscope full-range [24]. Therefore the 
two central bins comprise most of the data points and 
this prevents Alice to reliably identify the input state, 
see SI Fig. S9. 

For the generation rate, the number of bits necessary 
for the switching between the two conjugate quadratures 
must be accounted: following El, we set Uq = ^/m 
with m the total number of measurements in both the 
quadratures. Out of the m measurements, the check 


instants can be chosen in 




different ways. A 


given random combination then can be encoded in a seed 
t{m) = |■log 2 nQ\{m-nQy^ ^6 evaluated then 

the secure generation rate, i.e. the net number of true 
random bits per measurement, according 


— {m - nQ)[-c{5j) 


-f^max(Q5, )] - (5) 


Given the total amount of measurements being m = 
6I55I4II2 we employed n = — 24810 bits to eval¬ 

uate the conditional min-entropy. It is well known that 
the oscilloscope has an effective resolution lower than the 
nominal 8 bits, when the sampling rate is high. Hence, 
we used a conservative bit depth of 5 bits satisfying 



FIG. 3. Estimated entropy bounds H^owiPsj \E) for increas¬ 
ing Uq are reported as function of the measurement preci¬ 
sion, i.e. the resolution of the oscilloscope analog to digital 
converter (ADC). The dashed purple (color online) line cor¬ 
responds the Hmin{Psj)- The classical min-entropy overesti¬ 
mates the real amount of true random bits extractable, being 
the measured state equivalent to a thermal state. With a too 
low precision, the conditional min-entropy becomes not infor¬ 
mative because the resolution is too low to distinguish the 
input state. 


the SDI requirement of having a trusted and controlled 
measurement apparatus. Entropy was estimated to be 
Hi,ow{Pdp\E) > 1.3629 bits in average per measurement 
and a corresponding rate of r = 1.3617 bits. We gener¬ 
ated secure bits at the rate of 1.7 Gbit/s. 

Conelusions - At present time, ultimate randomness 
is reachable only by using device independent protocols 
of randomness expansion m or amplification na HD: 
however, such protocols are highly demanding from an 
experimental point of view. On the other hand, assuming 
the absence of local hidden variable theories, true random 
numbers can be obtained with “bottom up” approaches. 
Methods of recent introduction, evaluate the real content 
of entropy with an a priori characterization of the quan¬ 
tum system: by checking the state purity naEg or by 
checking the quantum system dimensions [26|. Our SDI 
protocol enables the ultra-fast generation of true ran¬ 
dom numbers. Our source-device-independent approach 
is motivated by experimental requirements: indeed, it is 
typically difficult to prepare and keep a real quantum sys¬ 
tem in a pure state. We have showed that unpredictable 
numbers can be distilled even if the quantum eavesdrop¬ 
per is providing the source of quantum states. 

Future steps will consider the possibility to merge our 
protocol with the “metrologic” approach introduced by 
Mitchell et al. m for the analysis of the technical 
noise added by every component of the hardware. Be¬ 
sides the security advantage, we have demonstrated the 
feasibility of the protocol with an ultra-fast, cheap and 
compact GV-QRNG. It is worth to remark that by us¬ 
ing commercial balanced receivers and fast LO phase 
shifter, the secure generation rate can be increased to 
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tens of Gbit/s. Further improvements can envisaged 
when squeezed states are used as input state for the pro¬ 
tocol. 
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DISCRETIZATION IN CV-QRNG 


CV-QRNGs are based on the measurement of quantum 
fluctuations of an electromagnetic (e.m.) mode quadra¬ 
ture by means of optical homodyne: a quantum state uja 
of a e.m. mode is combined with a classical field, the so 
called local oscillator (LO), by a beam splitter. 

For a given mode of the electromagnetic field, the 
generic quadrature operator can be expressed by q{ip) = 
2 “2 being d' and a the creation and 

annihilation operators such that [d^d)] = 1 holds. The 
canonically conjugated operators usually identified as the 
position Q and momentum V quadratures observables 
are given by Q = ^(0) and P = q{7r). They satisfy 
[Q,P] = i. The eigenvalues equations for position and 
momentum operators are given by Ql^) = q\q) with q gM. 
and P\p) = p\p) with p G M. 


If pA is assumed to be the vacuum state, i.e. pA = 
|0)(0|, its position and momentum representation are 
respectively given by '0o(^) = (^|0) = 7r“4e“^ and 
-00 (p) = (p|0) = For the vacuum |0), the 

probability distributions Q{q) = |'0o(^)P and P(p) = 
|'0o(p)P are Gaussian distribution with null average value 
and variance = 1 / 2 . 

With CV systems, the unavoidable discretization of the 
measurements due to the finite resolution of the exper¬ 
imental devices has to be considered. More specifically, 
a coarse grained version of operators can be obtained by 
introducing a partition Psp = {Isp}k^-oo measure 

space M m- The elements are given by half-open 
intervals such that = {k6p, {k Pl)6p] where 6p is the 
precision of the measurement and k e N. Alice applies 
POVMs jplpj with elements dp\p){p\ 

on A and she stores the outcomes pk in the classical 
system (register) Psp. The post-measurement state of 
Psp corresponds to the probability distribution of p/^. 


and it is given by pp = J2kPiPk)Psp where p{pk) = 
<^aPsp\ = dp{p\pA\p)- Similarly, the dis- 


Tr 


cretized Q operator is given by the POVMs with 

elements dq\q){q\. 


The estimation of max-entropy Pmax(Q^g) is based on 
the relative frequency of the outcomes of the discretized 
Q operator, as given by 




K{Q5q) — 


/ +00 ^ 

V Vviod 

Kk= — oo / 


(SI) 


While the sum in the above equation extends from —00 
to +00, experimental outcomes range from — M to +M 


due to experimental finite measurement range. Outcomes 
which exceed this range are registered asM+lor—M —1 
outcomes. We estimated the max-entropy by limiting the 
sum in m from —M to M and by neglecting the term 
^k>\M\ VPiPk)- We can upper bound such neglected 
terms, by considering a trial with a total of N measure- 
merits: defining Pm = EfcilooPfe) + ^e 

expect that n ^ PmN events result in an outcome out of 
range. The worst scenario, that maximize the neglected 
term, is given when each of the n outcomes falls into 
a different bin. In this situation, we have p{pk) ~ 
such that Efc>|M| \/p(Pfc) < ^ ^ VNPm- Since Pm 
corresponds to the double sided tail probability of the 
Gaussian distribution, a narrow distribution (i.e. a small 
standard deviation a compared to M6) corresponds to 
a low error in the min-entropy estimation. For the ex¬ 
perimental data presented in the main text, we have 
that MS ~ 10.5(7, with the max entropy evaluated on 
N ^ 2b ' 10^ measurements. Then, we estimate that the 
error introduced by the finite measurement range, is of 
order of 10“^^. 


EXAMPLE OF THE DIFFERENCE BETWEEN 
THE CLASSICAL AND THE QUANTUM 
MIN-ENTROPY 

In this section we show the difference between the clas¬ 
sical and quantum min-entropy for a CV-QRNG. In par¬ 
ticular, we will compare QRNGs based on two different 
inputs, a squeezed-state and a thermal state with the 
same output momentum distribution. We will show, that 
by measuring the system only in the momentum quadra¬ 
ture, it is not possible to correctly evaluate the condi¬ 
tional quantum min-entropy in both cases. 

Let’s first consider a CV-QRNG generator based on 
a ^-squeezed state as input. The wavefunction of 
a squeezed state is written in the Q and V space 

respectively as 'ip(^{q) = ~ 

. ^ ^ e~^ / 2 c^^ When (" > 1, Alice generates random 
v Ctt 

numbers by measuring the momentum quadrature V be¬ 
cause its variance (t‘^ = C^/2 is larger than the position 
variance (Jq = 1/(2C^). 

The outcomes of the momentum quadrature follow a 
Gaussian distribution given by 

. n{k + l/2)5p 

p(Pfc) = T^a[PspPa] = —j= / e dp. 

(S2) 

As said in the main text, the amount of true random 
bits can be evaluated by the quantum conditional min- 
entropy. In this case, since the input state is pure. 
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pA — |'0sq)('0sq| pA — Tl^ 


FIG. SI. left: Wigner function for a Q-squeezed vacuum 
state (C = 2) and the relative discretized probability distribu¬ 
tion (yellow histograms) for the two conjugate quadratures. 
Since the outcome distribution for V is wider, the outcomes 
of momentum measurements (performed with precision 5p) 
are used as random numbers. This is an ideal input state for 
a CV-QRNG: the state is pure and the randomness extrac¬ 
tor can be calibrated by the classical min-entropy i7min(7^5p)- 
right: Wigner function of a thermal state, that can be pu¬ 
rified by a two-mode squeezed vacuum. The probability dis¬ 
tribution for the P outcomes coincides with the distribution 
obtained with the Q-squeezed vacuum state. In this case, the 
classical min-entropy over-estimates the true content of ran¬ 
domness, because it does not take into account the quantum 
side information possessed by Eve. 


the quantum min-entropy is equal to the classical min- 
entropy evaluated on the outcomes. 


Hoo{Psp) = - log2[maxp(pfe)] 
k 


= - log2 


I 

TtC^ J-6pI2 


e ^ 


(S3) 


Indeed, since the state is pure, the optimal eavesdropper 
strategy is to bet on the most likely results. 

The same output momentum quadrature distribution 


(S2) can be obtained when the input state is thermal 
= ^5^ En(tanhg)^"|n)(n| and 2sinh^C = - 1 


(see Fig. [Slj ). The mean photon number of such ther¬ 
mal state is given by /i = sinh^ The mixedness of 
the thermal state implies a correlation with the environ¬ 
ment. For instance, a purification pae of Pa is repre¬ 
sented by the two mode squeezed vaeuum state^ = 
^^En(tanhe"|«)yi|n)E, where ^ is a squeezing pa- 
rameter. This state can be regarded as an optical ap¬ 
proximate version of an EPR entangled state and it has 
been recently used in a CV-QKD scheme [28]. If Eve 
controls the system she can gain information on the 
quadrature outputs measured by Alice. Indeed, measure¬ 
ments performed on each system of the entangled pair 
give (anti-) correlated outputs with high probabilities. 

The conditional min-entropy is now lower that the clas¬ 
sical min-entropy and its value should be evaluated by the 





EIG. S2. Left: i7min(P) (red dashed line) and Hi,ow{P\E) 
(green line) are reported as function of the degree of squeezing 
C for a given precision {S = 0.22). 


following equation: 


H^in{Psp\E) = - log2 max^p(pfc)Tr[4pf^^]. (S4) 

{Su} ^ 

In the previous equation pj^ ^ is the quantum state hold 
by Eve when the output k is obtained, namely: 

=TrA[P^pPAE], (S5) 

while the maximization is performed over general POVM 
{Sk} that Eve could measure. The conditional min- 
entropy is hard to evaluate, but a lower bound can be 
obtained by the measurement in the conjugate quadra¬ 
ture Q, as explained in the main text: 

Hmin{PSp\E) > Hi,ow{Psp\E) (S6) 


with 


Hlow{P5p\E) = - log2 c{Sq, 5p) - 2 log2 E] vEok) 

k 

(S7) 

In Figure SI we show the Wigner functions of the 
squeezed and thermal state with the same V distribu¬ 
tion. The difference between the two Q distribution is 
evident. The impurity of the thermal state may be in¬ 
deed detected by Alice by observing that that the (check) 
Q quadrature variance is not squeezed. However, it is 
not necessary to abort the protocol: Alice can still ex¬ 
tract random bits by calibrating a quantum randomness 
extractor with the conditional min-entropy. The estima¬ 
tion of a lower, conservative, bound to this quantity can 
be obtained by the relation (S6). 


In Figure we show the value of the classical min- 
entropy and the lower bound Hi,ow{P\E) for a thermal 
state. It is worth noticing that high squeezing corre¬ 
sponds to strong correlations with the Environment: by 
increasing Eve may gain more information about Al- 























ice system: H^i^{Psp\E) decreases because the fraction 
of bits known by Eve becomes larger. On the other side, 
Hmin{P6p) increases because the distribution of momen¬ 
tum outcomes approaches to the uniform distribution. 


This examples stresses the complete unsuitability of 
the use of classical min-entropy as an estimator for the 
security of QRNG: the application of a randomness ex¬ 
tractor based on this estimator does not allow the user 
Alice to eliminate the full quantum side information pos¬ 
sessed by Eve. 


The quantities Hi^oy^{P\E) and Hoo{P) can be evalu¬ 
ated analytically in the approximation of high precision 
(namely for (5^0). Eor a thermal state pxh with aver¬ 
age photon number fi the probability to obtain a given 
outcome qk or pk is given, for small 6q and 6p, by 




p{qk) - 


6q e 

y7r(l + 2/i) ’ 


P{Pk) - 


5pe 


{5p kp 

l + 2Ai 


^tt{1 + 2p) 


(S8) 


The max-entropy for the Q quadrature can be written as 
= 21 og 2 X]fc Vpi^k), an it can be explicitly 
evaluated as: 

= log 2 . + 2 logs V e • 

V7r(l + 2p) ^ 

(S9) 

On the other side, the classical min-entropy is given by 

6p 

Hp, = - max logs (p(pfe)) - - log 2 . , (SIO) 

V7r(l + 2/u) 


Considering small 5q and 5p and using the above max- 
entropy, the bound on the conditional min-entropy (eq. 
(§ of the main text) becomes: 

5q 

HlOw{P 5 p\E) = i^min(^( 5 p) “ 2 log2 ^='^3(0, 6 2(1+2^) ) ^ 

V ZTT 

(Sll) 

with 'dsiz^q) the Jacobi theta-function. Since 

2 

X'd 3 ( 0 ,e“^ ) > for X > 0 it is easy to prove that 
the r.h.s. is always lower than the classical min-entropy 
HminiPdp)^ Moreover, since lim^^o ^'^^3(0, 
in the limit of infinite precision Sq^Sp 0 we have 

HlOw{P6p\E) - - log 2 (l + 2/i) (S12) 


Eor the pure vacuum state, corresponding to /i = 0 the 
bound coincides with classical min-entropy (see Eig. 1 of 
the main text for J ^ 0). Eor a thermal state with /i > 0, 
the additional term log 2 (l + 2/i) prevents to obtain the 
equality between the two entropies: also in case of infi¬ 
nite precision the bound of the conditional min-entropy 
is always lower than the classical min-entropy. 



FIG. S3. The classical noise of the generator components 
cannot be separated from the quantum noise of the vacuum 
fluctuations: the neat effect therefore is a widening of the 
measured vacuum state outcome distribution as if the input 
state was a thermal state. 


EXPERIMENTAL SETUP 


Si 


A scheme of the experimental setup is reported in Eig. 
The local oscillator is provided by a Thorlabs SFL- 
1550 fiber coupled laser centered at 1550 nm. The laser 
is driven by a current and temperature controller which 
keep the laser operating in a single mode region. The 
laser output is connected to a Thorlabs VOA50 single 
mode fiber broadband variable attenuator. This device 
is essential to control the local oscillator power without 
modifying the optimal working region. The attenuator is 
connected to one input of a first 50:50 fiber beamsplit¬ 
ter, with the two outputs which go to a power meter 
and to a second 50:50 fiber beamsplitter, respectively. 
The power meter is used to monitor the power, while 
the last beamsplitter brings the signal into the balanced 
receiver. The superposition of the LO and the vacuum 
states entering from the unused ports of the beamsplit¬ 
ters, is then detected and converted in current by a pair of 
InGaAs PINs included in the single self-contained Thor¬ 
labs PDB480C. This device, with a nominal bandwidth 
of 1.6 GHz, takes the difference and amplifies the PIN sig¬ 
nals. Such monolithic configuration helps consistently to 
reduce the coupling with environmental electromagnetic 
noise. In addition to a low level of intrinsic technical 
noise (combination of thermal, dark current, amplifiers 
noise), the device features a common mode rejection ratio 
(GMRR) of over 30 dB in line with the performances of 
other receivers used in Literature for GV-QRNG. These 
two characteristics are of main relevance. On one hand, 
intrinsic technical noise does not cancel by taking the 
difference of the signals: then, a lower detector noise cor¬ 
responds to an higher quantum-signal to classical-noise 
ratio. On the other hand, the more the PIN are matched 
in responsivity, the more effective is the cancellation of 
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L.O. = 1550 nm Laser 

V.S. = Vacuum State 

P.M. = Power Meter 

OSC. = Oscilloscope 

B.S. = 50:50 

V.A. = Variable 

B.R. = Balanced 
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Attenuator 

Receiver 
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FIG. S4. In Figure a scheme of the experimental setup is 
reported. The QRNG was realized with hber coupled com¬ 
mercial components. 


the external classical noise affecting both the modes (e.g. 
spurious oscillation of the LO). It is worth to remark that 
the setup components are “commercial of the shelves”, 
(COTS). The use of COTS devices was motivated by the 
possibility to demonstrate the feasibility of the method 
and how security can be provided to CV-QRNG for the 


common use. 


The final stage of the setup consisted of an oscillo¬ 
scope Tektronix TDS6124C featuring a bandwidth of 
12 GHz was used as ADG. The oscilloscope was remotely 
controlled with a personal computer for the logging of the 
waveforms which later analyzed to get the raw random 
numbers and the check basis numbers to apply the EUP 
protocol. 

In Fig. S5, the typical Power Spectral Density (PSD) 
of the output signal is reported. In particular the PSD 
with the LO turned off (black trace) and with a 6.5 mW 
LO (blue trace) is reported. In order to filter out those 
regions of the spectrum affected by technical noise and to 
enhance the signal-to-noise ratio, we digitally downmixed 
and low-pass filtered the signal. We considered a fiat 
region 1.250 GHz wide, with optimal central frequency 
at /o = 1.055 GHz. 

The quadrature signal was obtained by digital per¬ 
forming a downsampling to 1.25 GSamples/s, in order to 
match the Nyquist frequency of the low-pass filter and 
to eliminate the correlations due to oversampling. On 
this regard in Fig. [S6l we report the correlation function 
before (top) and after (down) the downsampling. Before 
downsampling, the correlation shows the sine modula¬ 
tion imposed by the low-pass filter. After downsampling, 
the residual correlation is, in average, of two orders of 
magnitude lower. 

In Figure S7 we show the variance of quadrature 
signal in function of the LO power. We varied the LO 
power between 0.5 mW and 9 mW in steps of 0.5 mW. 
The linearity is clearly evident between 0.5 and 6.6 mW. 
Above 7.0 mW the loss of linearity can be ascribed to 
PIN and transimpendance amplifiers saturation, cfr. [29] 
and [30] . 


FIG. S5. The power spectral density function of the signals 
with LO turned off (black line) and with a LO power of 6 mW 
(blue line) is reported. The green shaded region identihes the 
1.250 GHz wide region of the spectrum which was considered 
for the extraction of the raw random numbers. The signal 
has been downmixed with a sinusoidal carrier at frequency 
/o = 1.055 GHz and then hltered with a low-pass hlter with 
625 MHz cut off frequency. 


By considering the region between 0.5 mW and 6.5 
mW, a linear fit gives the angular coefficient m = 
0.0108 V‘^/W and the intercept a = 2.579-10-^ The 
presence of a not-null intercept a 7^ 0 is the signature of 
the experimental noise having a non-quantum origin. At 
the base of the plot, the red shaded area marks the re¬ 
gion where technical noise is dominant. This noise can 
not be eliminated and it ends up in the signal generating 
the raw random numbers, affecting their security. 


As reported in the Main Text, we consider a typical 
run of m ~ 6 • 10^ data samples. In Fig. the ex¬ 
pected quadrature distribution (green solid line) is com¬ 
pared with the distribution obtained by fitting the ex¬ 
perimental data (red solid line and blue points respec¬ 
tively). A widening of the quadrature variance is ob¬ 
served, = 0.677 instead of the ideal = 1/2, 
see Fig. [S8| Because is it not possible to discriminate 
whether the source of the extra noise resides in the prepa¬ 
ration or in the measurement stage, according to our pro¬ 
tocol the input state is treated as mixed state detected 
by a perfect detector. As specified in the Main Text, 
to simulate the estimation the entropy bounds with the 
active switching of the measurement bases, we extracted 
random subsets of samples that were attributed to the 
as “check position quadrature”. In the following, the 
amount of secure random bits that can be extracted in 
function of the ADG precision and of number of check 
measurements, will be presented. 
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Experimental Autocorrelation 



n (multiples of Ts) 



200 400 600 

n (multiples of Ts) 
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FIG. S6. Top: experimental autocorrelation of the filtered 
data as function of the temporal separation in multiple of the 
sampling interval Ts . The correlation is modulated according 
a sine function. This is indeed the expected behavior once 
that a signal is filtered by a low pass filter, top inset. By 
means of the Wiener-Kitchine theorem one can analytically 
calculate the zeros of the autocorrelation and then the cor¬ 
responding down sampling frequency in order to achieve a 
null self-correlation. Bottom: by downsampling the origi¬ 
nal waveforms, the quadrature measurements become uncor¬ 
related. 



FIG. S7. The plot shows the linear relation between the LO 
power and the measured voltages variances. Between 0.5 mW 
and 7 mW we are in a QNL region whereas at 7.5 mW tran- 
simpendance amplifiers start to saturate with a not linear 
response of the detectors, evidenced in the red shaded region 
on the right. The red shaded region below represents the 
contribution of the technical noise. 
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Quadrature Value 


RATES 

We evaluated the secure generation rate, i.e. the neat 
number of true random bits per measurement, according 

^sec ~ HqjiaxiQdj)] t(Tfl) (S13) 

varying the precision 5j with j G {0,1,2,3} with the re¬ 
sults are represented in Fig. |S1Q[ The rates tend to the 
asymptotic value of r —~ ^1/2(Q^) 
for m ^ 00, cfr. m- The red lines and the orange 
areas represent the expected average rate and the 3cr un¬ 
certainty respectively, obtained by simulating the check 
measurement with a gaussian probability distribution 
having the same measured variance of the sample set. 
Each blue point with 3cr error bar, corresponds instead 
to the averages of r, being every average evaluated on 
200 random data set of size y/m with m G {2^, ..., 2^^}. 
As one can see, there is a remarkable agreement between 


FIG. S8. In Figure, the comparison between the ideal prob¬ 
ability distribution of a pure state (green solid line) and the 
fitted distribution (red solid line) of the actual experiment 
data (blue points).) 


the expected and the experimental values. 

For what concerns a real implementation of the pro¬ 
tocol, an advantage in using the highest precision of the 
ADC, lies in the fact that one would need much more 
measurements to reach a given rate value but with a lower 
precision. The green shaded area in the plot marks the 
regions where the distance to the asymptotic limit is less 
than the 5% and which starts at m = 2.1-10^: if a QRNG 
were provided with the equivalent of a squashed quantum 
state with this same dg, with a sampling rate of 2 GS/s 
and a full resolution of 8 bits, the generator could provide 
a quantum secure rate of roughly 8.71 Gbit/s. 
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ADC RESOLUTION 8 BIT ADC RESOLUTION 7 BIT 



FIG. S9. In the picture, the various probability distribu¬ 
tion obtained by measuring the state with different equivalent 
ADC resolutions are reported. One notices that the lower the 
resolution, the more unsharpened is the distribution. 



FIG. SIO. In Figure the theoretical and experimental rates, 
red lines and blue points respectively, are reported for differ¬ 
ent precisions Sj with j G {1,2, 3,4} as function of the total 
number of measurements m. For every m, theoretical lines 
were obtained averaging 100 rate values calculated on sim¬ 
ulated sample gaussian distributions with the same variance 
of the used dataset. The orange shaded areas correspond to 
expected the 3cr errors. The blue points are the averages of 
the rates evaluated on 200 random samples of size 
one see there is a remarkable agreement between experimen¬ 
tal points and expected results. In particular one has that 
for m ^ oo, the rates tend to an asymptotic value equal to 
the min conditional entropy. The green dashed line marks the 
regions where one has less than the 5% of distance from the 
asymptotic value. 
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PROTOCOL’S NOISE RESILIENCY 


Our protocol is dynamically resilient to varying noise 
conditions because the fraction of extracted true random 
bits is proportional to the signal to noise (SNR) ratio. In 
this regard, in Fig. |S11[ the bounds on the entropies are 
evaluated as function of the LO power. When the power 
is low, the quantum signal to classical noise ratio is low 
and correspondingly the thermal signal features a wider 
variance. Hence, the protocol automatically extracts a 
lower amount of true random bits. 


RESULTS OF THE STATISTICAL TESTS 


For the post-processing of the numbers, we imple¬ 
mented the fast computable two-universal hash function 
introduced in [18]. The final net total amount of secure 
random bits from the data set considered in the Main 
Text, amounted to 8.4 • 10^. These were obtained by 
taking the modulo sum 2 of the product between sub¬ 
strings n = 10000 bits long and a n x I random ma¬ 
trix with I = 2725 (corresponding to the ratio between 
Hhow{Psp\E) and the binary encoding of a single mea¬ 
surements, i.e. 5 bits). In this proof of principle, the 
hash matrix was generated for every substring using the 
pseudo-random number generator of the processing soft¬ 
ware: naturally a real implementation would require a 
seed of true random numbers to be stored inside the gen¬ 
erator. We tested the numbers with standard NIST sta¬ 
tistical tests in order to assess the statistical quality of 
the numbers: it is worth stressing that once the extractor 
is properly calibrated and the hash matrix is truly ran¬ 
dom, the post-processed numbers are expected to pass 
the tests. This was indeed the case as one can see from 

Fig.D 


1 


2 


5 


6 















































12 



FIG. S12. The stacked plots represents the passing ratio for 
the NIST test suite SP-800-22. Histograms correspond to 
four different strings 200® bit long. Each of the 16 tests was 
applied on 200 substrings 10® bits long and a bin represents 
the fraction of strings which passed a given test. The red line 
corresponds to the critical passing ratio. 





